CVE-2026-93078
In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Set Features output buffer smaller than the header cxlctl_set_feature() sizes its output buffer from the user's fwctl_rpc.out_len but never checks it is large enough to hold even the fwctl_rpc_cxl_out header. With out_len == 0 , kvzalloc() returns ZERO_SIZE_PTR, which passes the !rpc_out check, the subsequent rpc_out->size = 0 then writes through the poison pointer. Reject requests whose output buffer can't hold the response header, before allocating. The Set Feature reply carries no payload, so the header is all that is required.
Affected versions
Linux kernel versions
6.15
and later are affected. Fixed in
6.18.52,
7.2.6,
7.3-rc1
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-93078?
CVE-2026-93078 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.15 onward and has been patched in 6.18.52, 7.2.6 and 7.3-rc1. CVE-2026-93078 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-93078?
Yes. CVE-2026-93078 has been patched. Fixed versions include 6.18.52, 7.2.6 and 7.3-rc1. If you are running Linux kernel 6.15 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-93078 actively exploited?
No. CVE-2026-93078 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.